endorlabs/Endor Labs Scan
Endor Labs repository scan
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- Apache 2.0
Pinned Snippet
uses: endorlabs/github-action@f46ffb04c928a9c9c356f9627bd60b710ed0963e # v1.1.13tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| additional_args | "Use this to add custom arguments to the endorctl command." | — | — |
| api | "Set to the Endor Labs API to use." | — | https://api.endorlabs.com |
| api_key | "Set the API key used to authenticate with Endor Labs". | — | — |
| api_secret | "Set the secret corresponding to the API key used to authenticate with Endor Labs." | — | — |
| ci_run | — | — | true |
| ci_run_tags | — | — | — |
| enable_github_action_token | "Set to `false` if you prefer to use another form of authentication over GitHub action OIDC tokens." | — | true |
| enable_pr_comments | "Set to `true` to publish new findings as review comments. Must be used together with `pr` and `github_token`. Additionally, the `issues: write` and `pull-requests: write` permissions must be set in the workflow." | — | false |
| endorctl_checksum | "Set to the checksum associated with a pinned version of endorctl." | — | — |
| endorctl_version | "Set to a version of endorctl to pin this specific version for use. Defaults to the latest version." | — | — |
| export_scan_result_artifact | "Set to `false` to disable the json scan result artifact export." | — | true |
| gcp_service_account | "Set the target service account for GCP based authentication. GCP authentication is only enabled if this flag is set. Cannot be used with `api_key`." | — | — |
| github_token | "Set the token used to authenticate with GitHub. Required if `enable_pr_comments` is set to `true`." | — | — |
| log_level | "Set the endorctl log level, see also `log_verbose`." | — | info |
| log_verbose | "Set to `true` to enable verbose logging." | — | false |
| namespace | "Set to the namespace of the project that you are working with." | yes | — |
| output_file | "Set to the name of a file to save results to. File name will be in the `results` output item. Default just writes to STDOUT." | no | — |
| pr | "Set to `false` to track this scan in Endor Labs as a release, as opposed to a point in time policy and finding test for a PR." | — | true |
| pr_baseline | 'Set the baseline branch to enable action policies to only act on new findings. Must be used together with `pr` Example: `pr_baseline: "main"`.' | — | — |
| pr_incremental | "Set to `true` to only scan files, or packages with dependencies that have changed compared to the baseline scan. The GitHub PR ID or PR baseline must be available in order to use this option." | — | false |
| run_stats | "Set to `true` to report of CPU/RAM/time scan statistics via `time -v`; Linux runners only." | — | false |
| sarif_file | "Set to a location on your GitHub runner to output the findings in SARIF format." | — | — |
| scan_dependencies | "Scan git commits and generate findings for all dependencies." | — | true |
| scan_container | "Scan a specified container image. The image must be set with `image` and a project can be defined with `project_name`." | — | false |
| image | "Specify a container image to scan." | — | — |
| image_tar | "Specify a container image tar file to scan (alternative to `image`)." | — | — |
| as_ref | "Scan container in a persistent context and keep the version." | — | false |
| os_reachability | "Enable OS reachability analysis for container scans." | — | false |
| project_name | "Specify a project name for a container image scan." | — | — |
| project_tags | "Specify a comma-separated list of user-defined tags to add to the container scan project." | — | — |
| container_scan_path | "Set the path to a valid git repository for container scan context." | — | . |
| profiling_data_dir | "Add a directory containing profiling data to include in the container scan." | — | — |
| scan_package | "Scan a specified artifact or a package. The path to an artifact must be set with `scan_path`." | — | false |
| scan_tools | "Scan source code repository for CI/CD tools." | — | false |
| scan_git_logs | "Perform a more complete and detailed scan of secrets in the repository history. Must be used together with `scan_secrets`." | — | false |
| scan_github_actions | "Scan source code repository for github actions used in workflow files to analyze vulnerabilities and malware." | — | false |
| scan_path | "Set to the path to scan. Defaults to the current working directory." | — | . |
| scan_secrets | "Scan source code repository and generate findings for secrets. See also `scan_git_logs`." | — | false |
| scan_sast | "Scan source code repository and generate findings for SAST." | — | false |
| scan_ai_sast | "Scan source code repository and generate findings for AI SAST." | — | false |
| scan_ai_models | "Scan source code repository for AI models." | — | false |
| scan_summary_output_type | "Set the desired output format to one of: `table`, `json`, `yaml`, or `summary`." | — | json |
| tags | "Specify a list of user-defined tags to add to this scan. Tags can be used to search and filter scans later." | — | — |
| use_bazel | "Enable the usage of Bazel for the scan." | — | false |
| bazel_exclude_targets | "Specify a a list of Bazel targets to exclude from scan." | — | — |
| bazel_include_targets | "Specify a list of Bazel targets to scan. If `bazel_targets_include` is not set the `bazel_targets_query` value is used to determine with bazel targets to scan." | — | — |
| bazel_targets_query | "Specify a Bazel query to determine with Bazel targets to scan. Ignored if `bazel_targets_include` is set." | — | — |
| phantom_dependencies | "Enable phantom dependency analysis to identify dependencies used, but not declared in the manifest file." | — | false |
| disable_code_snippet_storage | "Do not store or display the source code related to a finding." | — | false |
Outputs
no outputs